CVE-2026-61924: Windows 10 1607 Information Disclosure Flaw

CVE-2026-61924 Overview

CVE-2026-61924 is an out-of-bounds read vulnerability [CWE-125] in the Microsoft Windows Remote Desktop Client. An unauthenticated attacker can trigger the flaw over a network to disclose sensitive information from the client process memory. The issue affects a broad range of Windows desktop and Windows Server releases, including current builds of Windows 11 and Windows Server 2025. Exploitation requires no privileges and no user interaction according to the CVSS vector, making the flaw attractive for reconnaissance and follow-on attacks against workstations that initiate Remote Desktop Protocol (RDP) sessions to attacker-controlled endpoints.

Critical Impact
A network-reachable attacker can read out-of-bounds memory from the Remote Desktop Client, potentially exposing credentials, session data, or other sensitive process memory without authentication.

Affected Products

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2) across x86, x64, and ARM64
Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H1) across x64 and ARM64
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-08-11 - CVE-2026-61924 published to the National Vulnerability Database (NVD)
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-61924

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the Remote Desktop Client component shipped with Windows. When the client parses server-supplied data during an RDP session, it reads beyond the bounds of an allocated buffer. The extra bytes returned to the client contain adjacent process memory rather than validated protocol data.

Because the read occurs client-side, an attacker who controls or impersonates an RDP server can weaponize the flaw against any Windows host that connects to it. The disclosed memory can include leftover heap contents, pointers useful for bypassing Address Space Layout Randomization (ASLR), or cached authentication material. The CVSS vector indicates a confidentiality-only impact with no effect on integrity or availability.

Root Cause

The root cause is missing or insufficient bounds validation on a length field or offset processed from the RDP data stream. The client trusts a server-supplied size value and copies or reads based on it, exceeding the actual allocation. Microsoft has not published low-level implementation details in the public advisory.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction beyond initiating an RDP connection. Typical exploitation scenarios include:

A user connecting mstsc.exe to an attacker-controlled RDP server on the internet or inside a compromised network segment.
An attacker performing man-in-the-middle interception of an RDP connection to inject malformed server responses.
A malicious RDP file (.rdp) delivered by phishing that redirects the client to a hostile endpoint.

The vulnerability manifests during RDP protocol parsing on the client. Refer to the Microsoft CVE-2026-61924 Advisory for vendor technical guidance.

Detection Methods for CVE-2026-61924

Indicators of Compromise

Outbound RDP sessions (TCP/3389 or UDP/3389) from user workstations to untrusted or previously unseen external IP addresses.
Unexpected mstsc.exe process launches spawned by browsers, mail clients, or Office applications, often indicating a delivered .rdp file.
Crashes or abnormal termination of mstsc.exe shortly after connecting to a remote host, which may indicate probing or failed exploitation.

Detection Strategies

Hunt for .rdp file creations in user download and temp directories, correlated with subsequent execution of mstsc.exe.
Alert on RDP connections initiated by end-user endpoints to destinations outside the enterprise RDP allow list.
Monitor for anomalous memory-read patterns or heap access violations in the Remote Desktop Client process.

Monitoring Recommendations

Ingest endpoint process telemetry and Sysmon events (process create, network connect) into a centralized SIEM for correlation.
Track outbound TCP/3389 and UDP/3389 flows at network perimeter devices and flag connections to non-corporate destinations.
Review Windows Event Log channels Microsoft-Windows-TerminalServices-ClientActiveXCore/Microsoft-Windows-TerminalServices-RDPClient for unusual client-side connection activity.

How to Mitigate CVE-2026-61924

Immediate Actions Required

Apply the Microsoft security updates referenced in the Microsoft CVE-2026-61924 Advisory to all affected Windows and Windows Server systems.
Block outbound RDP traffic (TCP/3389 and UDP/3389) at the network perimeter except to explicitly approved destinations.
Restrict execution of .rdp files delivered via email or web downloads through mail gateway and endpoint policies.

Patch Information

Microsoft has published fixes through the standard Windows Update channel. Administrators should deploy the cumulative update that addresses CVE-2026-61924 for each affected Windows 10, Windows 11, and Windows Server release. See the Microsoft CVE-2026-61924 Advisory for the applicable KB articles and downloads.

Workarounds

Enforce Group Policy that restricts the Remote Desktop Client to connect only to internal, trusted RDP endpoints.
Require RDP connections to traverse a Remote Desktop Gateway with certificate pinning and enforced Network Level Authentication (NLA).
Educate users to reject unsolicited .rdp files and to avoid connecting to untrusted remote hosts until patches are deployed.

bash

# Block outbound RDP to untrusted destinations using Windows Defender Firewall
New-NetFirewallRule -DisplayName "Block Outbound RDP TCP" `
  -Direction Outbound -Protocol TCP -RemotePort 3389 `
  -Action Block -Profile Any

New-NetFirewallRule -DisplayName "Block Outbound RDP UDP" `
  -Direction Outbound -Protocol UDP -RemotePort 3389 `
  -Action Block -Profile Any